Skip to content

Commit 3ec186f

Browse files
AkihiroSudaAkihiroSuda
committed
go.mod: experimental integration of gomodjail (library sandbox)
https://github.com/AkihiroSuda/gomodjail gomodjail imposes syscall restrictions on a specific set of Go modules (excepts ones that use unsafe pointers, reflections, etc.), so as to mitigate their potential vulnerabilities and supply chain attack vectors. Usage: ``` gomodjail run --go-mod=./go.mod -- nerdctl run hello-world ``` TODO: pack gomodjail, go.mod, and nerdctl into a single binary Hint: use `git diff --word-diff` for reviewing the changes in this commit Signed-off-by: Akihiro Suda <[email protected]>
1 parent d13fb45 commit 3ec186f

File tree

3 files changed

+37
-17
lines changed

3 files changed

+37
-17
lines changed

‎.github/workflows/test.yml

+3
Original file line numberDiff line numberDiff line change
@@ -299,6 +299,9 @@ jobs:
299299
run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=false
300300
- name: "Test (network driver=slirp4netns, port driver=builtin) (flaky)"
301301
run: docker run -t --rm --privileged -e WORKAROUND_ISSUE_622=${WORKAROUND_ISSUE_622} ${TEST_TARGET} /test-integration-rootless.sh ./hack/test-integration.sh -test.only-flaky=true
302+
- name: "Smoke test with gomodjail (may fail; not a blocker for merging PRs)"
303+
# TODO: replace /usr/local/bin/nerdctl with a gomodjail wrapper and run the entire integration tests
304+
run: docker run -t --rm --privileged ${TEST_TARGET} gomodjail --go-mod=/go/src/github.com/containerd/nerdctl/go.mod -- nerdctl run --rm hello-world
302305

303306
build:
304307
timeout-minutes: 5

‎Dockerfile

+12
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ ARG GOTESTSUM_VERSION=v1.12.0
4949
ARG NYDUS_VERSION=v2.3.0
5050
ARG SOCI_SNAPSHOTTER_VERSION=0.8.0
5151
ARG KUBO_VERSION=v0.32.1
52+
ARG GOMODJAIL_VERSION=master
5253

5354
FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1 AS xx
5455

@@ -116,6 +117,16 @@ RUN xx-go --wrap && \
116117
make build && \
117118
xx-verify --static cmd/ipfs/ipfs && cp -a cmd/ipfs/ipfs /out/${TARGETARCH}
118119

120+
FROM build-base-debian AS build-gomodjail
121+
ARG GOMODJAIL_VERSION
122+
ARG TARGETARCH
123+
RUN git clone https://github.com/AkihiroSuda/gomodjail.git /go/src/github.com/AkihiroSuda/gomodjail
124+
WORKDIR /go/src/github.com/AkihiroSuda/gomodjail
125+
RUN git checkout ${GOMODJAIL_VERSION} && \
126+
mkdir -p /out/${TARGETARCH}
127+
RUN GO=xx-go STATIC=1 make && \
128+
xx-verify --static _output/bin/gomodjail && cp -a _output/bin/gomodjail /out/${TARGETARCH}
129+
119130
FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS build-base
120131
RUN apk add --no-cache make git curl
121132
RUN git config --global advice.detachedHead false
@@ -296,6 +307,7 @@ RUN fname="soci-snapshotter-${SOCI_SNAPSHOTTER_VERSION}-${TARGETOS:-linux}-${TAR
296307
tar -C /usr/local/bin -xvf "${fname}" soci soci-snapshotter-grpc
297308
# enable offline ipfs for integration test
298309
COPY --from=build-kubo /out/${TARGETARCH:-amd64}/* /usr/local/bin/
310+
COPY --from=build-gomodjail /out/${TARGETARCH:-amd64}/* /usr/local/bin/
299311
COPY ./Dockerfile.d/test-integration-etc_containerd-stargz-grpc_config.toml /etc/containerd-stargz-grpc/config.toml
300312
COPY ./Dockerfile.d/test-integration-ipfs-offline.service /usr/local/lib/systemd/system/
301313
COPY ./Dockerfile.d/test-integration-buildkit-nerdctl-test.service /usr/local/lib/systemd/system/

‎go.mod

+22-17
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
//gomodjail:confined
12
module github.com/containerd/nerdctl/v2
23

34
go 1.23.0
@@ -9,23 +10,23 @@ require (
910
github.com/compose-spec/compose-go/v2 v2.4.9
1011
github.com/containerd/accelerated-container-image v1.3.0
1112
github.com/containerd/cgroups/v3 v3.0.5
12-
github.com/containerd/console v1.0.4
13+
github.com/containerd/console v1.0.4 //gomodjail:unconfined
1314
github.com/containerd/containerd/api v1.8.0
14-
github.com/containerd/containerd/v2 v2.0.3
15-
github.com/containerd/continuity v0.4.5
15+
github.com/containerd/containerd/v2 v2.0.3 //gomodjail:unconfined
16+
github.com/containerd/continuity v0.4.5 //gomodjail:unconfined
1617
github.com/containerd/errdefs v1.0.0
17-
github.com/containerd/fifo v1.1.0
18+
github.com/containerd/fifo v1.1.0 //gomodjail:unconfined
1819
github.com/containerd/go-cni v1.1.12
1920
github.com/containerd/imgcrypt/v2 v2.0.0
2021
github.com/containerd/log v0.1.0
2122
github.com/containerd/nerdctl/mod/tigron v0.0.0
2223
github.com/containerd/nydus-snapshotter v0.15.0
23-
github.com/containerd/platforms v1.0.0-rc.1
24+
github.com/containerd/platforms v1.0.0-rc.1 //gomodjail:unconfined
2425
github.com/containerd/stargz-snapshotter v0.16.3
2526
github.com/containerd/stargz-snapshotter/estargz v0.16.3
2627
github.com/containerd/stargz-snapshotter/ipfs v0.16.3
2728
github.com/containerd/typeurl/v2 v2.2.3
28-
github.com/containernetworking/cni v1.2.3
29+
github.com/containernetworking/cni v1.2.3 //gomodjail:unconfined
2930
github.com/containernetworking/plugins v1.6.2
3031
github.com/coreos/go-iptables v0.8.0
3132
github.com/coreos/go-systemd/v22 v22.5.0
@@ -35,26 +36,26 @@ require (
3536
github.com/docker/docker v28.0.1+incompatible
3637
github.com/docker/go-connections v0.5.0
3738
github.com/docker/go-units v0.5.0
38-
github.com/fahedouch/go-logrotate v0.2.1
39-
github.com/fatih/color v1.18.0
39+
github.com/fahedouch/go-logrotate v0.2.1 //gomodjail:unconfined
40+
github.com/fatih/color v1.18.0 //gomodjail:unconfined
4041
github.com/fluent/fluent-logger-golang v1.9.0
4142
github.com/fsnotify/fsnotify v1.8.0
4243
github.com/go-viper/mapstructure/v2 v2.2.1
4344
github.com/ipfs/go-cid v0.5.0
4445
github.com/klauspost/compress v1.18.0
45-
github.com/mattn/go-isatty v0.0.20
46+
github.com/mattn/go-isatty v0.0.20 //gomodjail:unconfined
4647
github.com/moby/sys/mount v0.3.4
4748
github.com/moby/sys/signal v0.7.1
48-
github.com/moby/sys/userns v0.1.0
49-
github.com/moby/term v0.5.2
50-
github.com/muesli/cancelreader v0.2.2
49+
github.com/moby/sys/userns v0.1.0 //gomodjail:unconfined
50+
github.com/moby/term v0.5.2 //gomodjail:unconfined
51+
github.com/muesli/cancelreader v0.2.2 //gomodjail:unconfined
5152
github.com/opencontainers/go-digest v1.0.0
5253
github.com/opencontainers/image-spec v1.1.1
5354
github.com/opencontainers/runtime-spec v1.2.1
5455
github.com/pelletier/go-toml/v2 v2.2.3
55-
github.com/rootless-containers/bypass4netns v0.4.2
56-
github.com/rootless-containers/rootlesskit/v2 v2.3.4
57-
github.com/spf13/cobra v1.9.1
56+
github.com/rootless-containers/bypass4netns v0.4.2 //gomodjail:unconfined
57+
github.com/rootless-containers/rootlesskit/v2 v2.3.4 //gomodjail:unconfined
58+
github.com/spf13/cobra v1.9.1 //gomodjail:unconfined
5859
github.com/spf13/pflag v1.0.6
5960
github.com/vishvananda/netlink v1.3.0
6061
github.com/vishvananda/netns v0.0.5
@@ -63,8 +64,8 @@ require (
6364
golang.org/x/crypto v0.36.0
6465
golang.org/x/net v0.37.0
6566
golang.org/x/sync v0.12.0
66-
golang.org/x/sys v0.31.0
67-
golang.org/x/term v0.30.0
67+
golang.org/x/sys v0.31.0 //gomodjail:unconfined
68+
golang.org/x/term v0.30.0 //gomodjail:unconfined
6869
golang.org/x/text v0.23.0
6970
gopkg.in/yaml.v3 v3.0.1
7071
gotest.tools/v3 v3.5.2
@@ -105,6 +106,7 @@ require (
105106
github.com/moby/sys/mountinfo v0.7.2 // indirect
106107
github.com/moby/sys/sequential v0.6.0 // indirect
107108
github.com/moby/sys/symlink v0.3.0 // indirect
109+
//gomodjail:unconfined
108110
github.com/moby/sys/user v0.3.0 // indirect
109111
github.com/mr-tron/base58 v1.2.0 // indirect
110112
github.com/multiformats/go-base32 v0.1.0 // indirect
@@ -118,6 +120,7 @@ require (
118120
github.com/philhofer/fwd v1.1.3-0.20240612014219-fbbf4953d986 // indirect
119121
github.com/pkg/errors v0.9.1 // indirect
120122
github.com/sasha-s/go-deadlock v0.3.5 // indirect
123+
//gomodjail:unconfined
121124
github.com/sirupsen/logrus v1.9.3 // indirect
122125
github.com/smallstep/pkcs7 v0.1.1 // indirect
123126
github.com/spaolacci/murmur3 v1.1.0 // indirect
@@ -135,7 +138,9 @@ require (
135138
go.opentelemetry.io/otel/trace v1.31.0 // indirect
136139
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
137140
google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 // indirect
141+
//gomodjail:unconfined
138142
google.golang.org/grpc v1.69.4 // indirect
143+
//gomodjail:unconfined
139144
google.golang.org/protobuf v1.36.2 // indirect
140145
lukechampine.com/blake3 v1.3.0 // indirect
141146
)

0 commit comments

Comments
 (0)